chore(ci): raise the dev PR gate to Typecheck + Unit Tests (linux) (middle-tier gating)

[LeXwDeX]

Why

The Typecheck-only PR→dev gate let a missing-SPDX regression (#368) merge and keep dev's push-triggered full run red for 75 minutes. That class (assertion-level breakage) is exactly what Unit Tests (linux) catches pre-merge. Full gating (adding E2E) buys little for its 20-40min/PR cost: dev→main already runs the full suite and release is manually triggered.

What (middle tier)

1. ci-test.yml: add pull_request → dev to the trigger set (currently push-only on dev, PR→main only)
2. protect-dev Ruleset: required checks = Typecheck + Unit Tests (linux)
3. spec_git/policy.yaml: required_checks = [Typecheck, Unit Tests (linux)] (hand-maintained — the auto-detector cannot be trusted until it skips matrix-placeholder names and dispatch-only workflows)

Acceptance

• a delivery PR to dev runs both jobs and both must pass to merge
• specgit finish evaluates both checks
• E2E stays push-on-dev + dev→main only

[LeXwDeX]

Delivered via PR #371 (merged to dev). Middle-tier gate live: PRs to dev require Typecheck + Unit Tests (linux); E2E stays push-on-dev + dev->main. Ruleset note: maintainer to add 'Unit Tests (linux)' to protect-dev required checks if desired (repo settings). specgit finish exit 0.